Credential stuffing and brute force

Backend security Mid-level Python 3.13+ PostgreSQL 17+ Reviewed By Best Latest Apps

Pick the fix

Logins show 50,000 failures an hour across 8,000 IPs, about 6 per IP. What helps most?

Options
Hint 1 of 1

How many tries does each IP make?

Choose an answer, then open Show answer below to check it.

Show answer

Answer: A Per-account limits with backoff, breached-password checks and step-up MFA

Correct. IP limits barely bite when each IP tries a few times.

Credential stuffing tries leaked username and password pairs from many IPs, a few attempts each. Defences that follow the account or the password, like per-account limits, breached-password checks and MFA, still work.

Why not the others?
  • B Block each IP after 10 failures. Each IP stays under the limit.
  • C Permanently lock every targeted account. Locks out the real users.
  • D Tell users which part was wrong. Helps attackers enumerate accounts.

30-second answer

Rate-limit by account and by source (IP, subnet, device fingerprint), with growing delays rather than permanent lockouts that let attackers lock out real users. Check passwords against breach corpora at signup and login, push MFA or passkeys, add bot detection or a challenge when signals look bad, and notify users of new-device sign-ins. Return the same error for 'no such user' and 'wrong password' so the login doesn't confirm which emails exist.

Practise saying it · 30 s. No recording, just a timer

Defend logins.

Say your answer out loud, then check which of these points you covered:

  • Limits by account and source
  • Backoff, not lockout
  • Breach checks
  • MFA / passkeys
  • Uniform errors

Deep dive

Have I Been Pwned's range API lets you check a password hash prefix without sending the password.

Track failed attempts in Redis with TTLs.

Distributed attacks use many IPs, so per-account limits matter.

Watch login success-rate dips as an attack signal.

Common mistakes

  • Locking accounts permanently after 5 failures.
  • Different errors for unknown email and wrong password.
  • Rate-limiting by IP only.

Senior take & follow-ups

Layered: limits by account and source, breach checks, MFA, bot signals, uniform errors.

Follow-up questions

Think of your answer first, then open the hint.

  1. Why avoid hard lockouts?

    Show hint

    Attackers can lock out any user on purpose.

  2. How do you check breached passwords privately?

    Show hint

    k-anonymity: send the first 5 hex characters of the SHA-1 hash.

Related questions

Suggest a fix if something here is wrong or out of date.